Configuring Password Complexity in Active Directory

6.3K

Domain user passwords are an important part of the security of your Active Directory domain. An AD system administrator can manage domain password policies using Group Policy Objects and Password Settings Objects. In this article, we’ll show you how to set up or change the password complexity policy in Active Directory.

Active Directory Password Complexity

Password policy settings in Active Directory include the following parameters:

Minimum password length

This parameter defines the minimum number of characters required in a password.

Password complexity requirements

AD can enforce traditional password complexity rules that require characters from multiple categories (such as uppercase letters, lowercase letters, numbers, and special characters). However, these composition rules should not be treated as the primary measure of password strength.

Modern password guidance favors longer passwords/passphrases and blocking commonly used or compromised passwords. Users often satisfy mandatory character requirements by making predictable changes, such as adding a number or ! to an otherwise weak password. NIST SP 800-63B Revision 4 prohibits verifiers from imposing composition rules for memorized passwords (such as requiring specific combinations of uppercase letters, lowercase letters, numbers, or special characters).

In modern enterprise environments, you should prioritize password length and screen passwords against known weak/compromised credentials. We recommend using Microsoft Entra Password Protection to enforce Microsoft’s global banned-password list and your organization’s custom banned-password list. With the required on-premises components, you can also apply this protection to Active Directory DCs.

Blocking weak and compromised passwords

Password length alone does not prevent users from choosing passwords that are already widely known or exposed in data breaches. A password such as CompanyName2026! may satisfy traditional complexity requirements while still being easy to guess/already compromised.

Modern identity platforms use password blocklists to prevent users from choosing common, predictable, or compromised passwords. Microsoft Entra Password Protection provides you with a global banned-password list and allows organizations to add their own custom terms. It can also be deployed to on-premises Active Directory DCs in hybrid environments.

In enterprise environments, we recommend combining minimum password length with password screening instead of relying on character-composition rules alone.

Default domain password policy settings

By default, the following password complexity settings are configured in the AD domain based on Windows Server 2016:

Setting	Default Value
Minimum password length	7 characters (default domain policy)
Maximum password age	42 days
Minimum password age	1 day
Complexity requirements	Enabled
Password history	24 passwords
Reversible encryption	Disabled

Although AD uses 7 characters as the default minimum password length, you should not use this as a modern security baseline. NIST SP 800-63B Revision 4 recommends at least 15 characters for passwords used as a single authentication factor and allows a minimum of 8 characters when MFA is used. In enterprise environments, we recommend using longer passwords or passphrases whenever possible.

The default 42-day maximum password age is also a legacy Windows setting, not a universal security best practice. We recommend against forcing users to change passwords on a fixed schedule. Instead, require a password change when there is evidence that a password has been compromised/when a specific organizational or regulatory requirement calls for it.

If a user tries to set a password that does not match the password policy in the AD domain when logging into Windows or changing the password via Ctrl+Alt+Delete, an error message will be displayed:

Unable to update the password. The value provided for the new password does not meet the domain’s length, complexity, or history requirements.

Note that password policy applies only at the domain level (Default Domain Policy).

Configuring the Active Directory password policy settings

In order to configure the default domain password policy:

1. First, open gpmc.msc
2. Then expand your domain
3. On the next step, right-click on Default Domain Policy, then click Edit
   

   

4. Now navigate to:
   Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Password Policy
5. At this step, you need to configure the required settings:
   – Minimum password length
   – Password must meet complexity requirements
   – Enforce password history
   

   

 Note. Keep in mind that the password policy that you have configured in the Default Domain Policy applies to all domain users.

Comparing GPO and PSO

Method	Scope	Priority / Behavior	Management Tool
Default Domain Policy (GPO)	All domain users	Lower — applies when no PSO is assigned	gpmc.msc
PSO (Fine-Grained Password Policy)	Specific users or groups	Higher — overrides GPO when assigned	dsac.msc or PowerShell

Note. In case a few PSOs apply to the same user, the one with the lowest Precedence number takes priority. As an example: a PSO with Precedence 1 takes priority over a PSO with Precedence 10. The Default Domain Policy is always overridden by any PSO.

How to Configure Password Policy using PowerShell

To view the current default domain password policy:

Get-ADDefaultDomainPasswordPolicy

To set the minimum password length to 12 characters:

Set-ADDefaultDomainPasswordPolicy `
-Identity "theitbros.com" `
-MinPasswordLength 12 `
-PasswordHistoryCount 24 `
-ComplexityEnabled $true

Fine-Grained Password Policies (FGPP)

Fine-Grained Password Policies (FGPP) were introduced in Windows Server 2008 and allow different password policies to be applied to specific users and global security groups within the same domain. For current Windows Server environments, you should use a domain functional level of Windows Server 2012 or later in order to create Fine-Grained Password Policies (FGPPs).

You can do this Password Settings Objects (PSO).

How to configure Fine-Grained Password Policies using dsac.msc

1. First, open dsac.msc (Active Directory Administrative Center)
2. Now go to System → Password Settings Container
3. Here you click New → Password Settings
4. Now you need to configure password settings (length, complexity, history, etc.)
5. In Directly applies to, add users or groups

How to configure Fine-Grained Password Policies using PowerShell

You can configure FGPP with PowerShell console:

New-ADFineGrainedPasswordPolicy `
-Name "AdminPasswordPolicy" `
-Precedence 10 `
-MinPasswordLength 16 `
-PasswordHistoryCount 24 `
-ComplexityEnabled $true

Note that our example does not config periodic password expiration. Modern password guidance generally recommends changing passwords when they are compromised rather than forcing users to change them on a fixed schedule. If your organization has a specific compliance/security requirement for password expiration, you should config MaxPasswordAge according to that requirement.

After the step above, you need to apply PSO to a group:

Add-ADFineGrainedPasswordPolicySubject `
-Identity "AdminPasswordPolicy" `
-Subjects "Domain Admins"

When to use Fine-Grained Password Policies?

You should use FGPP in case:

• You need stricter policies for administrators
• Different departments of your organization need different rules
• Default domain policy is not flexible enough

Your new password complexity settings will now apply to all users in the specified group.

You can display the current password policy settings for a specific user using PowerShell (it shows which password policy is applied):

Get-ADUserResultantPasswordPolicy -Identity b.johnson

Password Protection in Hybrid Environments

In hybrid AD environments, password complexity policies can be complemented by Microsoft Entra Password Protection. Unlike the standard password complexity policy, Microsoft Entra Password Protection blocks weak and commonly used passwords by checking them against Microsoft’s global banned password list and optionally against a custom banned password list defined by the organization. The feature can also be deployed on-premises so that Active Directory DCs enforce the same password restrictions during password changes. Password complexity requirements and Microsoft Entra Password Protection are complementary technologies and are commonly used together in enterprise environments.

Wrapping Up

Configuring password complexity in Active Directory is important for strong security standards. Active Directory offers tools like the Group Policy Management Console and the Active Directory Administrative Center, making it easier for IT professionals to manage and apply password policies. It’s vital to set appropriate minimum password lengths, understand the importance of password history, and avoid methods like reversible encryption.

Organizations can use the fine-grained password policies feature to apply specific password policies to particular user groups. By understanding and using complexity requirements in Active Directory effectively, companies can help to bolster their cybersecurity posture and help prevent password breaches and compromise.